1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2017 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <darrick.wong@oracle.com>
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_btree.h"
13 #include "xfs_log_format.h"
14 #include "xfs_trans.h"
15 #include "xfs_inode.h"
16 #include "xfs_icache.h"
17 #include "xfs_alloc.h"
18 #include "xfs_alloc_btree.h"
19 #include "xfs_ialloc.h"
20 #include "xfs_ialloc_btree.h"
21 #include "xfs_refcount_btree.h"
23 #include "xfs_rmap_btree.h"
25 #include "xfs_trans_priv.h"
26 #include "xfs_da_format.h"
27 #include "xfs_da_btree.h"
29 #include "xfs_reflink.h"
31 #include "scrub/scrub.h"
32 #include "scrub/common.h"
33 #include "scrub/trace.h"
34 #include "scrub/repair.h"
35 #include "scrub/health.h"
37 /* Common code for the metadata scrubbers. */
40 * Handling operational errors.
42 * The *_process_error() family of functions are used to process error return
43 * codes from functions called as part of a scrub operation.
45 * If there's no error, we return true to tell the caller that it's ok
46 * to move on to the next check in its list.
48 * For non-verifier errors (e.g. ENOMEM) we return false to tell the
49 * caller that something bad happened, and we preserve *error so that
50 * the caller can return the *error up the stack to userspace.
52 * Verifier errors (EFSBADCRC/EFSCORRUPTED) are recorded by setting
53 * OFLAG_CORRUPT in sm_flags and the *error is cleared. In other words,
54 * we track verifier errors (and failed scrub checks) via OFLAG_CORRUPT,
55 * not via return codes. We return false to tell the caller that
56 * something bad happened. Since the error has been cleared, the caller
57 * will (presumably) return that zero and scrubbing will move on to
60 * ftrace can be used to record the precise metadata location and the
61 * approximate code location of the failed operation.
64 /* Check for operational errors. */
78 /* Used to restart an op with deadlock avoidance. */
79 trace_xchk_deadlock_retry(
80 sc->ip ? sc->ip : XFS_I(file_inode(sc->file)),
85 /* Note the badness but don't abort. */
86 sc->sm->sm_flags |= errflag;
90 trace_xchk_op_error(sc, agno, bno, *error,
104 return __xchk_process_error(sc, agno, bno, error,
105 XFS_SCRUB_OFLAG_CORRUPT, __return_address);
109 xchk_xref_process_error(
110 struct xfs_scrub *sc,
115 return __xchk_process_error(sc, agno, bno, error,
116 XFS_SCRUB_OFLAG_XFAIL, __return_address);
119 /* Check for operational errors for a file offset. */
121 __xchk_fblock_process_error(
122 struct xfs_scrub *sc,
124 xfs_fileoff_t offset,
133 /* Used to restart an op with deadlock avoidance. */
134 trace_xchk_deadlock_retry(sc->ip, sc->sm, *error);
138 /* Note the badness but don't abort. */
139 sc->sm->sm_flags |= errflag;
143 trace_xchk_file_op_error(sc, whichfork, offset, *error,
151 xchk_fblock_process_error(
152 struct xfs_scrub *sc,
154 xfs_fileoff_t offset,
157 return __xchk_fblock_process_error(sc, whichfork, offset, error,
158 XFS_SCRUB_OFLAG_CORRUPT, __return_address);
162 xchk_fblock_xref_process_error(
163 struct xfs_scrub *sc,
165 xfs_fileoff_t offset,
168 return __xchk_fblock_process_error(sc, whichfork, offset, error,
169 XFS_SCRUB_OFLAG_XFAIL, __return_address);
173 * Handling scrub corruption/optimization/warning checks.
175 * The *_set_{corrupt,preen,warning}() family of functions are used to
176 * record the presence of metadata that is incorrect (corrupt), could be
177 * optimized somehow (preen), or should be flagged for administrative
178 * review but is not incorrect (warn).
180 * ftrace can be used to record the precise metadata location and
181 * approximate code location of the failed check.
184 /* Record a block which could be optimized. */
186 xchk_block_set_preen(
187 struct xfs_scrub *sc,
190 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_PREEN;
191 trace_xchk_block_preen(sc, xfs_buf_daddr(bp), __return_address);
195 * Record an inode which could be optimized. The trace data will
196 * include the block given by bp if bp is given; otherwise it will use
197 * the block location of the inode record itself.
201 struct xfs_scrub *sc,
204 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_PREEN;
205 trace_xchk_ino_preen(sc, ino, __return_address);
208 /* Record something being wrong with the filesystem primary superblock. */
211 struct xfs_scrub *sc)
213 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
214 trace_xchk_fs_error(sc, 0, __return_address);
217 /* Record a corrupt block. */
219 xchk_block_set_corrupt(
220 struct xfs_scrub *sc,
223 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
224 trace_xchk_block_error(sc, xfs_buf_daddr(bp), __return_address);
227 /* Record a corruption while cross-referencing. */
229 xchk_block_xref_set_corrupt(
230 struct xfs_scrub *sc,
233 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
234 trace_xchk_block_error(sc, xfs_buf_daddr(bp), __return_address);
238 * Record a corrupt inode. The trace data will include the block given
239 * by bp if bp is given; otherwise it will use the block location of the
240 * inode record itself.
243 xchk_ino_set_corrupt(
244 struct xfs_scrub *sc,
247 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
248 trace_xchk_ino_error(sc, ino, __return_address);
251 /* Record a corruption while cross-referencing with an inode. */
253 xchk_ino_xref_set_corrupt(
254 struct xfs_scrub *sc,
257 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
258 trace_xchk_ino_error(sc, ino, __return_address);
261 /* Record corruption in a block indexed by a file fork. */
263 xchk_fblock_set_corrupt(
264 struct xfs_scrub *sc,
266 xfs_fileoff_t offset)
268 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
269 trace_xchk_fblock_error(sc, whichfork, offset, __return_address);
272 /* Record a corruption while cross-referencing a fork block. */
274 xchk_fblock_xref_set_corrupt(
275 struct xfs_scrub *sc,
277 xfs_fileoff_t offset)
279 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
280 trace_xchk_fblock_error(sc, whichfork, offset, __return_address);
284 * Warn about inodes that need administrative review but is not
288 xchk_ino_set_warning(
289 struct xfs_scrub *sc,
292 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_WARNING;
293 trace_xchk_ino_warning(sc, ino, __return_address);
296 /* Warn about a block indexed by a file fork that needs review. */
298 xchk_fblock_set_warning(
299 struct xfs_scrub *sc,
301 xfs_fileoff_t offset)
303 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_WARNING;
304 trace_xchk_fblock_warning(sc, whichfork, offset, __return_address);
307 /* Signal an incomplete scrub. */
310 struct xfs_scrub *sc)
312 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_INCOMPLETE;
313 trace_xchk_incomplete(sc, __return_address);
317 * rmap scrubbing -- compute the number of blocks with a given owner,
318 * at least according to the reverse mapping data.
321 struct xchk_rmap_ownedby_info {
322 const struct xfs_owner_info *oinfo;
323 xfs_filblks_t *blocks;
327 xchk_count_rmap_ownedby_irec(
328 struct xfs_btree_cur *cur,
329 const struct xfs_rmap_irec *rec,
332 struct xchk_rmap_ownedby_info *sroi = priv;
336 irec_attr = rec->rm_flags & XFS_RMAP_ATTR_FORK;
337 oinfo_attr = sroi->oinfo->oi_flags & XFS_OWNER_INFO_ATTR_FORK;
339 if (rec->rm_owner != sroi->oinfo->oi_owner)
342 if (XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) || irec_attr == oinfo_attr)
343 (*sroi->blocks) += rec->rm_blockcount;
349 * Calculate the number of blocks the rmap thinks are owned by something.
350 * The caller should pass us an rmapbt cursor.
353 xchk_count_rmap_ownedby_ag(
354 struct xfs_scrub *sc,
355 struct xfs_btree_cur *cur,
356 const struct xfs_owner_info *oinfo,
357 xfs_filblks_t *blocks)
359 struct xchk_rmap_ownedby_info sroi = {
365 return xfs_rmap_query_all(cur, xchk_count_rmap_ownedby_irec,
372 * These helpers facilitate locking an allocation group's header
373 * buffers, setting up cursors for all btrees that are present, and
374 * cleaning everything up once we're through.
377 /* Decide if we want to return an AG header read failure. */
379 want_ag_read_header_failure(
380 struct xfs_scrub *sc,
383 /* Return all AG header read failures when scanning btrees. */
384 if (sc->sm->sm_type != XFS_SCRUB_TYPE_AGF &&
385 sc->sm->sm_type != XFS_SCRUB_TYPE_AGFL &&
386 sc->sm->sm_type != XFS_SCRUB_TYPE_AGI)
389 * If we're scanning a given type of AG header, we only want to
390 * see read failures from that specific header. We'd like the
391 * other headers to cross-check them, but this isn't required.
393 if (sc->sm->sm_type == type)
399 * Grab the perag structure and all the headers for an AG.
401 * The headers should be released by xchk_ag_free, but as a fail safe we attach
402 * all the buffers we grab to the scrub transaction so they'll all be freed
403 * when we cancel it. Returns ENOENT if we can't grab the perag structure.
406 xchk_ag_read_headers(
407 struct xfs_scrub *sc,
411 struct xfs_mount *mp = sc->mp;
415 sa->pag = xfs_perag_get(mp, agno);
419 error = xfs_ialloc_read_agi(sa->pag, sc->tp, &sa->agi_bp);
420 if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGI))
423 error = xfs_alloc_read_agf(sa->pag, sc->tp, 0, &sa->agf_bp);
424 if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGF))
427 error = xfs_alloc_read_agfl(sa->pag, sc->tp, &sa->agfl_bp);
428 if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGFL))
434 /* Release all the AG btree cursors. */
440 xfs_btree_del_cursor(sa->refc_cur, XFS_BTREE_ERROR);
442 xfs_btree_del_cursor(sa->rmap_cur, XFS_BTREE_ERROR);
444 xfs_btree_del_cursor(sa->fino_cur, XFS_BTREE_ERROR);
446 xfs_btree_del_cursor(sa->ino_cur, XFS_BTREE_ERROR);
448 xfs_btree_del_cursor(sa->cnt_cur, XFS_BTREE_ERROR);
450 xfs_btree_del_cursor(sa->bno_cur, XFS_BTREE_ERROR);
460 /* Initialize all the btree cursors for an AG. */
463 struct xfs_scrub *sc,
466 struct xfs_mount *mp = sc->mp;
469 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_BNO)) {
470 /* Set up a bnobt cursor for cross-referencing. */
471 sa->bno_cur = xfs_allocbt_init_cursor(mp, sc->tp, sa->agf_bp,
472 sa->pag, XFS_BTNUM_BNO);
476 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_CNT)) {
477 /* Set up a cntbt cursor for cross-referencing. */
478 sa->cnt_cur = xfs_allocbt_init_cursor(mp, sc->tp, sa->agf_bp,
479 sa->pag, XFS_BTNUM_CNT);
482 /* Set up a inobt cursor for cross-referencing. */
484 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_INO)) {
485 sa->ino_cur = xfs_inobt_init_cursor(mp, sc->tp, sa->agi_bp,
486 sa->pag, XFS_BTNUM_INO);
489 /* Set up a finobt cursor for cross-referencing. */
490 if (sa->agi_bp && xfs_has_finobt(mp) &&
491 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_FINO)) {
492 sa->fino_cur = xfs_inobt_init_cursor(mp, sc->tp, sa->agi_bp,
493 sa->pag, XFS_BTNUM_FINO);
496 /* Set up a rmapbt cursor for cross-referencing. */
497 if (sa->agf_bp && xfs_has_rmapbt(mp) &&
498 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_RMAP)) {
499 sa->rmap_cur = xfs_rmapbt_init_cursor(mp, sc->tp, sa->agf_bp,
503 /* Set up a refcountbt cursor for cross-referencing. */
504 if (sa->agf_bp && xfs_has_reflink(mp) &&
505 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_REFC)) {
506 sa->refc_cur = xfs_refcountbt_init_cursor(mp, sc->tp,
507 sa->agf_bp, sa->pag);
511 /* Release the AG header context and btree cursors. */
514 struct xfs_scrub *sc,
517 xchk_ag_btcur_free(sa);
519 xfs_trans_brelse(sc->tp, sa->agfl_bp);
523 xfs_trans_brelse(sc->tp, sa->agf_bp);
527 xfs_trans_brelse(sc->tp, sa->agi_bp);
531 xfs_perag_put(sa->pag);
537 * For scrub, grab the perag structure, the AGI, and the AGF headers, in that
538 * order. Locking order requires us to get the AGI before the AGF. We use the
539 * transaction to avoid deadlocking on crosslinked metadata buffers; either the
540 * caller passes one in (bmap scrub) or we have to create a transaction
541 * ourselves. Returns ENOENT if the perag struct cannot be grabbed.
545 struct xfs_scrub *sc,
551 error = xchk_ag_read_headers(sc, agno, sa);
555 xchk_ag_btcur_init(sc, sa);
559 /* Per-scrubber setup functions */
562 * Grab an empty transaction so that we can re-grab locked buffers if
563 * one of our btrees turns out to be cyclic.
565 * If we're going to repair something, we need to ask for the largest possible
566 * log reservation so that we can handle the worst case scenario for metadata
567 * updates while rebuilding a metadata item. We also need to reserve as many
568 * blocks in the head transaction as we think we're going to need to rebuild
569 * the metadata object.
573 struct xfs_scrub *sc,
576 if (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR)
577 return xfs_trans_alloc(sc->mp, &M_RES(sc->mp)->tr_itruncate,
578 resblks, 0, 0, &sc->tp);
580 return xfs_trans_alloc_empty(sc->mp, &sc->tp);
583 /* Set us up with a transaction and an empty context. */
586 struct xfs_scrub *sc)
590 resblks = xrep_calc_ag_resblks(sc);
591 return xchk_trans_alloc(sc, resblks);
594 /* Set us up with AG headers and btree cursors. */
597 struct xfs_scrub *sc,
600 struct xfs_mount *mp = sc->mp;
604 * If the caller asks us to checkpont the log, do so. This
605 * expensive operation should be performed infrequently and only
606 * as a last resort. Any caller that sets force_log should
607 * document why they need to do so.
610 error = xchk_checkpoint_log(mp);
615 error = xchk_setup_fs(sc);
619 return xchk_ag_init(sc, sc->sm->sm_agno, &sc->sa);
622 /* Push everything out of the log onto disk. */
625 struct xfs_mount *mp)
629 error = xfs_log_force(mp, XFS_LOG_SYNC);
632 xfs_ail_push_all_sync(mp->m_ail);
637 * Given an inode and the scrub control structure, grab either the
638 * inode referenced in the control structure or the inode passed in.
639 * The inode is not locked.
643 struct xfs_scrub *sc)
645 struct xfs_imap imap;
646 struct xfs_mount *mp = sc->mp;
647 struct xfs_inode *ip_in = XFS_I(file_inode(sc->file));
648 struct xfs_inode *ip = NULL;
651 /* We want to scan the inode we already had opened. */
652 if (sc->sm->sm_ino == 0 || sc->sm->sm_ino == ip_in->i_ino) {
657 /* Look up the inode, see if the generation number matches. */
658 if (xfs_internal_inum(mp, sc->sm->sm_ino))
660 error = xfs_iget(mp, NULL, sc->sm->sm_ino,
661 XFS_IGET_UNTRUSTED | XFS_IGET_DONTCACHE, 0, &ip);
664 /* Inode doesn't exist, just bail out. */
667 /* Got an inode, continue. */
671 * -EINVAL with IGET_UNTRUSTED could mean one of several
672 * things: userspace gave us an inode number that doesn't
673 * correspond to fs space, or doesn't have an inobt entry;
674 * or it could simply mean that the inode buffer failed the
677 * Try just the inode mapping lookup -- if it succeeds, then
678 * the inode buffer verifier failed and something needs fixing.
679 * Otherwise, we really couldn't find it so tell userspace
680 * that it no longer exists.
682 error = xfs_imap(sc->mp, sc->tp, sc->sm->sm_ino, &imap,
683 XFS_IGET_UNTRUSTED | XFS_IGET_DONTCACHE);
686 error = -EFSCORRUPTED;
689 trace_xchk_op_error(sc,
690 XFS_INO_TO_AGNO(mp, sc->sm->sm_ino),
691 XFS_INO_TO_AGBNO(mp, sc->sm->sm_ino),
692 error, __return_address);
695 if (VFS_I(ip)->i_generation != sc->sm->sm_gen) {
704 /* Set us up to scrub a file's contents. */
706 xchk_setup_inode_contents(
707 struct xfs_scrub *sc,
708 unsigned int resblks)
712 error = xchk_get_inode(sc);
716 /* Got the inode, lock it and we're ready to go. */
717 sc->ilock_flags = XFS_IOLOCK_EXCL | XFS_MMAPLOCK_EXCL;
718 xfs_ilock(sc->ip, sc->ilock_flags);
719 error = xchk_trans_alloc(sc, resblks);
722 sc->ilock_flags |= XFS_ILOCK_EXCL;
723 xfs_ilock(sc->ip, XFS_ILOCK_EXCL);
726 /* scrub teardown will unlock and release the inode for us */
731 * Predicate that decides if we need to evaluate the cross-reference check.
732 * If there was an error accessing the cross-reference btree, just delete
733 * the cursor and skip the check.
736 xchk_should_check_xref(
737 struct xfs_scrub *sc,
739 struct xfs_btree_cur **curpp)
741 /* No point in xref if we already know we're corrupt. */
742 if (xchk_skip_xref(sc->sm))
749 /* If we've already given up on xref, just bail out. */
753 /* xref error, delete cursor and bail out. */
754 xfs_btree_del_cursor(*curpp, XFS_BTREE_ERROR);
758 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XFAIL;
759 trace_xchk_xref_error(sc, *error, __return_address);
762 * Errors encountered during cross-referencing with another
763 * data structure should not cause this scrubber to abort.
769 /* Run the structure verifiers on in-memory buffers to detect bad memory. */
772 struct xfs_scrub *sc,
777 if (bp->b_ops == NULL) {
778 xchk_block_set_corrupt(sc, bp);
781 if (bp->b_ops->verify_struct == NULL) {
782 xchk_set_incomplete(sc);
785 fa = bp->b_ops->verify_struct(bp);
788 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
789 trace_xchk_block_error(sc, xfs_buf_daddr(bp), fa);
793 * Scrub the attr/data forks of a metadata inode. The metadata inode must be
794 * pointed to by sc->ip and the ILOCK must be held.
797 xchk_metadata_inode_forks(
798 struct xfs_scrub *sc)
804 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
807 /* Metadata inodes don't live on the rt device. */
808 if (sc->ip->i_diflags & XFS_DIFLAG_REALTIME) {
809 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
813 /* They should never participate in reflink. */
814 if (xfs_is_reflink_inode(sc->ip)) {
815 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
819 /* They also should never have extended attributes. */
820 if (xfs_inode_hasattr(sc->ip)) {
821 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
825 /* Invoke the data fork scrubber. */
826 smtype = sc->sm->sm_type;
827 sc->sm->sm_type = XFS_SCRUB_TYPE_BMBTD;
828 error = xchk_bmap_data(sc);
829 sc->sm->sm_type = smtype;
830 if (error || (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
833 /* Look for incorrect shared blocks. */
834 if (xfs_has_reflink(sc->mp)) {
835 error = xfs_reflink_inode_has_shared_extents(sc->tp, sc->ip,
837 if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0,
841 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
848 * Try to lock an inode in violation of the usual locking order rules. For
849 * example, trying to get the IOLOCK while in transaction context, or just
850 * plain breaking AG-order or inode-order inode locking rules. Either way,
851 * the only way to avoid an ABBA deadlock is to use trylock and back off if
856 struct xfs_inode *ip,
861 for (i = 0; i < 20; i++) {
862 if (xfs_ilock_nowait(ip, lock_mode))
869 /* Pause background reaping of resources. */
872 struct xfs_scrub *sc)
874 sc->flags |= XCHK_REAPING_DISABLED;
875 xfs_blockgc_stop(sc->mp);
876 xfs_inodegc_stop(sc->mp);
879 /* Restart background reaping of resources. */
882 struct xfs_scrub *sc)
885 * Readonly filesystems do not perform inactivation or speculative
886 * preallocation, so there's no need to restart the workers.
888 if (!xfs_is_readonly(sc->mp)) {
889 xfs_inodegc_start(sc->mp);
890 xfs_blockgc_start(sc->mp);
892 sc->flags &= ~XCHK_REAPING_DISABLED;